IBM Using -Xgc:preferredHeapBase with -Xcompressedrefs - United States  TECHNOTE (FAQ)

QUESTION
 "Why does the JVM report a native out-of-memory (NOOM) when using compressed references? I am using a 64bit JVM and I clearly have plenty of memory left. How can I resolve this problem?"

CAUSE

*In this note, please refer to Java Versioning: Java Version.Release.ServiceRelease.FixPack
ex: Java 7.1.4.6 is the same as Java 7.1 SR4 FP6 is the same as Java 7 R1 SR4 FP6.
The IBM JVM will automatically use compressed references [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/understanding/mm_compressed_references.html]when using a maximum heap size less than 25GB. This automated behavior was introduced in Java 6.1.5.0 and Java 7.0.4.0*. Compressed references (CR) decreases the size of Java objects making better use of available memory space. This better use of space results in improved JVM performance. *(Java 7.0.1.1 and later uses compressed references by default on z/OS)

See Introducing WebSphere Compressed Reference Technology [ftp://public.dhe.ibm.com/software/webserver/appserv/was/WAS_V7_64-bit_performance.pdf] for detailed information on how Compressed References work.

"When using compressed references, the size of the field used in the Java object for the Class Pointer and the Monitor/Lock is 32 bits instead of the 64bits that would be available in non-compressed mode. Because we are using 32 bits to store the location of these, and they are located in native (non-Java heap) memory, they must be allocated in the first 4GB of the address space - the maximum range we can address with the 32 bits." ~IBM Java Development Team

If the Java heap itself is small (-Xmx), the JVM may allocate it in the lower 4GB of address space along with the Class Pointers and Monitors/Locks. If these Class Pointers, Monitors/Locks and Java heap (if included) cannot fit in the lower 4GB, a native out of memory (NOOM) [http://www.ibm.com/developerworks/library/j-nativememory-linux/] will be thrown.
ANSWER
Why Use Compressed References?

Below the 4GB mark, the JVM does not have to perform any compression/decompression of the address pointer at runtime. Therefore, the best performance will be attained if the Class Pointers, Monitors/Locks and Java heap can all be contained comfortably within the lowest 4GB of the address space.

Determining Address Location of Java Heap Memory

To verify if the Java heap has memory regions below the 4GB mark, check the "Object Memory" section in the javacore:

Convert the "start" address from the hex value to a GB value [http://ss64.com/convert.html]. In the example below, 0x000000000F010000=0.23GB which is below the the 4GB (0x0000000100000000) mark.

 * [/support/docview.wss?uid=swg21660890&aid=1]

Setting the Preferred Heap Base with -Xgc:preferredHeapBase

Starting with Java 6.1.6.0 and Java 7.0.5.0, and later, the JVM will determine if the Java heap will fit comfortably in the lower 4GB. If it is too large, the JVM will automatically allocate the Java heap above the 4GB mark (APAR IV37797 [http://www-01.ibm.com/support/docview.wss?uid=swg1IV37797]).

NOTE: In IBM System z platforms (i.e. z/OS and z/Linux), automatic shift of the heap above the 4GB address space does NOT occur because on these platforms, there is an additional performance penalty
associated with higher shift values. To resolve Native OOM issues due to a shortage of heap memory in the lower region on z platforms, use -Xnocompressedrefs (see below).
See related: IBM Knowledge Center - JVMJ9GC089W [https://www.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.messages/diag/appendixes/messages/j9gc/message_jvmj9gc089.html] However, in earlier Java 6.1 and Java 7.0 versions (earlier than Java 6.1.6.0 and Java 7.0.5.0), if the Java heap can not fit in the lower 4GB, a NOOM will occur. To avoid this problem, the generic JVM argument [http://www-01.ibm.com/support/docview.wss?uid=swg21417365] -Xgc:preferredHeapBase=<address> [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/understanding/mm_compressed_references.html] can be used to ensure the Java heap is allocated above the 4GB address space. This will leave more room for the Class Pointer and Monitor/Lock memory.

 *
 *
 *
 *
 *
 *
 * This will locate the Java heap starting at the 4GB mark thus leaving the lower 4GB for the other processes.

Increase Maximum Heap Size to Force Heap Allocation Above the 4GB mark

Another way to ensure that the heap is allocated above the 4GB mark (Java 6.1.6.0 and Java 7.0.5.0 and later) is to set a maximum heap size equal to or greater than 4GB. For example -Xmx4G will ensure that the heap will have to be allocated above the 4GB mark. This will not work in earlier versions of the JVM since these earlier versions allowed the heap to straddle the 4GB mark, placing part of the memory above and some below (fixed as part of APAR IV37797) .

Further Investigation

If after setting -Xgc:preferredHeapBase=<address> or -Xmx4G a NOOM is still encountered (Java 6.1.6.0 and Java 7.0.5.0 and later), then further investigation is required at the application level. Look to decrease the size and usage of the applications Class Pointers and Monitors/Locks. Additionally, there are some WebSphere Application Server troubleshooting methods that may help reduce the native memory footprint. See: IBM Troubleshooting native memory issues [http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21373312].

Reserving Low-Memory Space with -Xmcrs

If there is still free memory in the system when a Native OutOfMemory (NOOM) occurs, then the problem may be a shortage of memory in the low-memory region (under 4GB). Even if the Java heap is located above this boundary, other data associated with Java objects can be located in the low-memory region.

The OS memory allocator will deal out low-memory freely, thus memory resources in the lower boundary may run out. Later when the JVM tries to allocate memory for an artifact which is required to be allocated in low-memory (because the JVM has only reserved a 32bit pointer for it) it fails and throws an OutOfMemoryError.

Starting in Java 6.0.16.3, Java 6.1.8.3, Java 7.0.8.10, Java 7.1.2.10, there is a parameter -Xmcrs [http://www-01.ibm.com/support/knowledgecenter/SSYKE2_6.0.0/com.ibm.java.doc.diagnostics.60/diag/appendixes/cmdline/xmcrs.html] which allows the JVM to increase the amount of low memory it reserves on startup. With this setting, as long as the low-memory usage by the JVM does not exceed the -Xmcrs value, NOOM in the lower boundary will be avoided.

To set this parameter, first decide what a reasonable value for your lower memory requirements may be. Reasonable value is unique to each environment so there is not a general recommendation.

 * -Xmcrs<reasonable_value_for_lower_memory>

 *
 * NATIVEMEMINFO subcomponent dump routine
 *
 *
 *
 *
 *
 *
 *
 *
 * [/support/docview.wss?uid=swg21660890&aid=2]
 *

Disabling Compressed References with -Xnocompressedrefs As a last resort, if the native memory still can not be contained under the 4GB mark, you can set -Xnocompressedrefs [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/appendixes/cmdline/Xnocompressedrefs.html] as a generic JVM argument. [http://www-01.ibm.com/support/docview.wss?uid=swg21417365] Using -Xnocompressedrefs will remove the use of compressed references and therefore remove the lower 4GB memory restriction on the Class Pointers and Monitors/Locks. This will however, result in a significant increase in Java heap memory requirements. It is not uncommon for 70% more heap space to be required. Due to the increased memory requirements it is strongly advised that the Java heap size is adjusted to a larger value and garbage collection is monitored and retuned as required.

Additionally, some benchmarks show a 10-20% relative throughput decrease when disabling compressed references: "Analysis shows that a 64-bit application without CR yields only 80-85% of 32-bit throughput but with CR yields 90-95%. Depending on application requirements, CR can improve performance up to 20% over standard 64-bit." See:ftp://public.dhe.ibm.com/software/webserver/appserv/was/WAS_V7_64-bit_performance.pdf [ftp://public.dhe.ibm.com/software/webserver/appserv/was/WAS_V7_64-bit_performance.pdf].

Before using -Xnocompressedrefs as a solution, first rule out the possibility of a native memory leak. Since using -Xnocompressedrefs will allow the the native memory to grow unbounded, a leak in native memory will lead to process size growth eventually leading to a process that needs to be paged out. The paging will incur performance overhead which will eventually lead to an unstable environment. Therefore careful consideration must be used when selecting -Xnocompressedrefs as a solution.

Memory Map Considerations

The below figure is a generalization of how the JVM handles addresses in each section of the memory map based on heap size and compressed references (CR). Please note that at each stage beyond having all of the Java memory contained below the 4GB mark, there will be performance consequences:

[/support/docview.wss?uid=swg21660890&aid=3]

No Compressed References Overhead using -Xnocompressedrefs
or
-Xmx > 25GB -increased memory footprint
-fewer/larger objects stored on heap leads to more frequent GC
-lower cache and translation look aside buffer (TLB) utilization [/support/docview.wss?uid=swg21660890&aid=4] Compressed References Overhead maximum heap address used by the Java JVM process is below 4GB none maximum heap address used by the Java JVM process is above 4GB but below 32GB compression/decompression of address pointers

Getting Assistance From IBM Support
If further assistance will be required from IBM WebSphere Support, please set the following -Xdump [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/tools/dumpagents_syntax.html] parameters in the generic JVM arguments [http://www-01.ibm.com/support/docview.wss?uid=swg21417365]:
 *
 *
 *

Then restart the JVM and recreate the problem. Once the NOOM is encountered, process the resulting system core with jextract [http://www-01.ibm.com/support/docview.wss?uid=swg21577379]. Send the jextracted core file, heapdump, javacore, snap trace, systemOut.log, native_stderr.log, native_stdout.log and systemErr.log to IBM Support [http://www-01.ibm.com/support/docview.wss?uid=swg21153852] for further analysis.
RELATED INFORMATION
 Linux/Windows - Thanks for the memory [http://www.ibm.com/developerworks/library/j-nativememory-linux/]
AIX - Thanks for the Memory [http://www.ibm.com/developerworks/library/j-nativememory-aix/]
Introducing WebSphere Compressed Reference Technology [ftp://public.dhe.ibm.com/software/webserver/appserv/was/WAS_V7_64-bit_performance.pdf]
Compressed references [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/understanding/mm_compressed_references.html]
IBM Java Compressed References and Native OOMs [https://www.ibm.com/developerworks/community/blogs/kevgrig/entry/ibm_java_compressed_references_and_native_ooms]

Question: How to remove the default -Xcompressedrefs from my WebSphere Application Server My understanding is that for performance reasons, the WebSphere Application server on 64bit JVMs is, by default, using compressed references (-Xcompressedrefs). Due to native OutOfMemory error, I would like to remove that default, so there is no such limitation imposed on my native memory size.

Answer: To avoid this problem, the generic JVM argument [http://www-01.ibm.com/support/docview.wss?uid=swg21417365] -Xgc:preferredHeapBase=<address> [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/understanding/mm_compressed_references.html] can be used to ensure the Java heap is allocated above the 4GB address space. This will leave more room for the Class Pointer and Monitor/Lock memory.


IBM Installation Manager does not work if symbolic links are used for Installation Manager of installed product locations - United States RN1.5; RN1.5.1; RN1.5.0.1; RN1.5.2; RN1.5.3; RN1.6; RN1.6.1; RN1.6.2; RN1.6.3; RN1.6.3.1; RN1.7; RN1.7.1; RN1.7.2; SRX; 1628092; RATLC02668456; IPL; Symlink TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You install IBM Installation Manager by using symbolic links at the root level for the agent data location or the installation location or for both locations and after a system change or system restart you cannot start Installation Manager or you cannot use Installation Manager to update or uninstall products.

CAUSE
When you install Installation Manager, the values for the agent data directory, the Installation Manager binaries, and the installation directories for products are stored internally as absolute paths with all the symbolic links resolved. If a symbolic link is used as part of the path for any of these directories or binaries, the symbolic link is replaced with its target value.
Similarly, when a product is installed with Installation Manager, the values for the installation location and shared resources directory are stored internally as absolute paths with all symbolic links resolved.

If the symbolic links change their values, the absolute path names for directories that are used by Installation Manager might change. When the Installation Manager starts, it will initialize itself using the data in the agent data location. However, the stored values for the paths to the agent data directory, Installation Manager binaries, or product installation locations do not point to the new locations. Installation Manager might fail to start, or might be unable to update or uninstall products that are installed.

RESOLVING THE PROBLEM
When choosing locations for the agent data directory, the Installation Manager binaries, shared resources directory, and the installation directories for products, do not use paths that include symbolic links.

If Installation Manager is using paths that no longer exist, create the old paths manually and mount the affected file systems at the original locations that are used by Installation Manager. Verify that the user IDs for Installation Manager have read access to each level of the recreated paths.

Question: Is it recommended to use symbolic links when installing Omnibus 8.1 fixpacks? Is it recommended to use symbolic links when installing Omnibus 8.1 fixpacks?

Answer: You install IBM Installation Manager by using symbolic links at the root level for the agent data location or the installation location or for both locations and after a system change or system restart you cannot start Installation Manager or you cannot use Installation Manager to update or uninstall products.


IBM Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-5461) - United States  SECURITY BULLETIN

SUMMARY
 IBM MQ Appliance has addressed a vulnerability in Network Security Services (NSS).

VULNERABILITY DETAILS
CVEID:CVE-2017-5461 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5461]
DESCRIPTION:Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library. By persuading a user to visit a specially-crafted website, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/125002 [https://exchange.xforce.ibmcloud.com/vulnerabilities/125002]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

AFFECTED PRODUCTS AND VERSIONS
IBM MQ Appliance 8.0

Maintenance levels between 8.0.0.0 and 8.0.0.6
IBM MQ Appliance 9.0.x Continuous Delivery (CD) Release

Continuous delivery updates between 9.0.1 and 9.0.3

REMEDIATION/FIXES
IBM MQ Appliance 8.0

Apply fixpack 8.0.0.7 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&release=8.0.0.6&platform=All&function=all]
IBM MQ Appliance 9.0.x Continuous Delivery (CD) Release

Apply the ifix for APAR IT21888 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&release=9.0.3&platform=All&function=all]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 24 Aug 2017 Updated to include IBM MQ Appliance 9.0.x CD release
14 Jul 2017 Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-5461) I need to understand details regarding Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-5461). Where can I find this information?

Answer:
CVEID:CVE-2017-5461 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5461]
DESCRIPTION:Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library. By persuading a user to visit a specially-crafted website, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/125002 [https://exchange.xforce.ibmcloud.com/vulnerabilities/125002]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)


IBM Policy (EJQAB0067E) and JCR Login (WSP0005E) exceptions in System*.logs - United States EJQAB0067E; WSP0005E; LoginException; policy; theme; attribute; JCR TECHNOTE (TROUBLESHOOTING)

PROBLEM
Policy (EJQAB0067E) and JCR Login (WSP0005E) exceptions occur in the System* logs when accessing Portal pages after user authentication.

SYMPTOM
SystemOut.log shows:

[datestamp] 00000241 PolicyService E com.ibm.wps.policy.services.PolicyService getPolicy Exception calling storage api: com.ibm.portal.WpsException: EJQAB0067E: An error occurred while getting the policy root.
[datestamp] 00000241 PolicyManager E com.ibm.wps.policy.services.PolicyManagerServerSideImpl getPVSByPath throwing exception. PVS type not found for theme/SingleTopNav

SystemErr.log shows:

[datestamp] 00000241 SystemErr R javax.jcr.LoginException: WSP0005E: Error calling IConnectionManager.logon() for reason: User id can not be null.: WSP0005E: Error calling IConnectionManager.logon() for reason: User id can not be null.
....
[datestamp] 00000241 SystemErr R Caused by: com.ibm.icm.da.DBAccessException: User id can not be null
[datestamp] 00000241 SystemErr R at com.ibm.icm.da.portable.connection.Logon.logon(Logon.java:177)

CAUSE
Authenticated user does not have the attribute defined in the backend user registry which matches the attribute defined in the store.puma_default.user.fbadefault.filter property in WP PumaStoreService Resource Environment Provider. Such attribute is used by JCR when querying for theme policy information.

DIAGNOSING THE PROBLEM
Collect the following:

 * LDIF export of a sample user that hits this problem (if the backend user registry is LDAP)  * If you cannot determine a specific user causing the error, you can use the following tracestring to confirm:

   *=info:com.ibm.wps.policy.services.*=finest:com.ibm.wps.policy.commands.*=finest

   Then look for the following line in trace.log: com.ibm.wps.policy.services.PolicyService PolicyService() ENTRY userid contructor: {DN of user}

 * Resources.xml - can be found under  * <wp_profile>/config/cells/<cellname>/clusters/<clustername>/ for cluster
    * <wp_profile>/config/cells/<cellname>/nodes/<nodename>/servers/<portalservername>/ for standalone

Locate the WP PumaStoreService Resource Environment Provider in resources.xml and confirm if there is a defined property name for store.puma_default.user.fbadefault.filter. If not, then the default and active value for such property is "uid". If it does exist, then verify the attribute defined for the value. Then check the LDIF export for the user to confirm if such attribute is defined.
RESOLVING THE PROBLEM
Create/update the store.puma_default.user.fbadefault.filter custom property for the WP PumaStoreService Resource Environment Provider via the Integrated Solutions Console to an attribute that exists for all Portal users in the backend user registry (for example, "cn").

RELATED INFORMATION
#Puma Store Service [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Puma_Store_Service_wp8]
Setting service configuration properties [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Setting_service_configuration_properties_wp8?OpenDocument&sa=true]

Question:
Non-admin users cannot access webDAV filestore. What is the likely reason? A non-admin user trying to access the webDAV filestore is unable to do so and they see the below exception in the portal logs:
Caused by: com.ibm.icm.da.DBAccessException: User id can not be null at com.ibm.icm.da.portable.connection.Logon.logon(Logon.java:159) at com.ibm.icm.da.portable.connection.ConnectionManager.logon(ConnectionManager.java:45)

Answer: Create/update the store.puma_default.user.fbadefault.filter custom property for the WP PumaStoreService Resource Environment Provider via the Integrated Solutions Console to an attribute that exists for all Portal users in the backend user registry (for example, "cn").


IBM Pdcollect tool for ITM IBM i OS agent - United States ITM_TEMA_DIST_CONFIGURATION ITM_i5_Agent 5724C04 A4 OS/400 i5/OS IBMi IBM i pdcollect TECHNOTE (FAQ)

QUESTION
 How do I collect logs and files for the IBM i OS agent?

ANSWER
The pdcollect tool for the IBM i OS agent allows you to easily and quickly collect the most commonly used information from an IBM i system for IBM Support to investigate a problem. The tool gathers log files, configuration information, version information, job information, message queue information, and basic system information.

Pdcollect is delivered in the IBM i OS agent beginning in ITM 6.23 FP5 and ITM 6.30 FP3. It is located in the following IFS directory:

/QIBM/ProdData/IBM/ITM/bin/pdcollect.sh

Pdcollect is also available as a downloadable file which is stored in an IFS directory chosen by the user. Download the following zip file to a local workstation and extract its contents. Follow the instructions in readme.txt for further information on installing the tool.

 pdcollect_ibmi_1.4.zip [/support/docview.wss?uid=swg21657023&aid=2]pdcollect_ibmi_1.4.zip [/support/docview.wss?uid=swg21657023&aid=1]

 The tool is executed by issuing the following shell script command in Qshell:

<directory>/pdcollect.sh

where <directory> is the IFS directory where the tool is stored.

You must execute pdcollect while running under a user profile that you use to run IBM Tivoli Monitoring to avoid problems with object authorities.

The output from the tool is a single compressed file that can be sent in binary form to IBM Support if requested. The output file is stored at the following location:

 /tmp/ITM/pdcollect_ibmi.tar.Z

The output file is overwritten each time the tool is run. Copy or rename the output file after each invocation if more than one data collection is needed.

Instructions to view the data that has been collected is displayed in a message at the end of pdcollect processing.

The pdcollect tool for the IBM i OS agent does not collect information from the Tivoli Enterprise Monitoring Server (TEMS) or Tivoli Enterprise Portal Server (TEPS) systems. You may be asked to collect additional information from your TEMS or TEPS systems separately.

Question: What is the equivalent of the .LG0 file for the OS agent - A4 - on i5 systems? What is the equivalent of the .LG0 file for the OS agent - A4 - on i5 systems?

Answer: The pdcollect tool for the IBM i OS agent allows you to easily and quickly collect the most commonly used information from an IBM i system for IBM Support to investigate a problem. The tool gathers log files, configuration information, version information, job information, message queue information, and basic system information.


IBM SPSS Student Version and Graduate Pack Resources - United States SPSS Support Acquisition Statistics Stats Grad Pack Student TECHNOTE (FAQ)

QUESTION
 Where do I get support for IBM SPSS Student Version or Graduate Pack software?

ANSWER
Step 1:
For installation & licensing issues on Student version and Graduate pack, contact your vendor.

 * Hearne [http://www.hearne.software/Software/SPSS-Grad-Packs-for-Students-by-IBM/FAQ]
 * On the Hub [http://onthehub.com/]
 * StudentDiscounts.com [http://studentdiscounts.com/contact-us.aspx]
 * JourneyEd [https://www.journeyed.com/contact]
 * thinkEDU [https://thinkedu.desk.com/]
 * Studica [http://www.studica.com/technical-support]

Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Amos Windows Not Applicable Grad Pack, Shrinkwrap, Campus Business Analytics SPSS Modeler Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Windows Not Applicable Business Analytics SPSS Statistics Platform Independent Not Applicable Campus Edition, Grad Pack, Student Version

Question: Authorization code missing for SPSS 25? I purchased the IBM SPSS from Amazon, and I do not know where to locate the authorization code of license code/key. Can anyone help me?

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.


IBM Insufficient Access Error adding documents to FileNet Content Engine - United States FNRCE0001E; E_ACCESS_DENIED; unable to add document TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 User is getting a security error when attempting to add a document to a folder in an object store via FileNet Workplace XT or FileNet Enterprise Manager.

Security Error seen: The requester has insufficient access rights to perform the requested operation.

CAUSE
User does not have Create_Instance right on the security permission of the ReferentialContainmentRelationship and DynamicReferentialContainmentRelationship classes and cannot create these objects when adding documents.

DIAGNOSING THE PROBLEM

 * User has necessary rights to the document class, folders and object store but can't add document.
 * User does not have necessary Create_Instance rights on the ReferentialContainmentRelationship and DynamicReferentialContainmentRelationship classes.
 * Error seen in the P8_server_error.log:

   YYYY-06-08T17:53:19.706Z 56005600 ENG FNRCE0001E - ERROR method name: checkUpdatePermissions principal name: username Global Transaction: true User Transaction: false Exception Info: The requester has insufficient access rights to perform the requested operation.
   com.filenet.api.exception.EngineRuntimeException: FNRCE0001E: E_ACCESS_DENIED: The requester has insufficient access rights to perform the requested operation. failedBatchItem=0 errorStack={

RESOLVING THE PROBLEM
Steps to resolve issue:

 1. Log in to FileNet Enterprise Manager.
 2. Grant the user CREATE_INSTANCE rights to the Security permission of the ReferentialContainmentRelationship and DynamicReferentialContainmentRelationship classes.
 3. Re-try adding the document.

Question: Unable to add the document using content Navigator. We are getting the following error code. CIWEB1158. The user is unable to add the document using content Navigator. We are getting the following error code. CIWEB1158.

Answer: User does not have Create_Instance right on the security permission of the ReferentialContainmentRelationship and DynamicReferentialContainmentRelationship classes and cannot create these objects when adding documents.


IBM IV67523 Move local data from CANDLEHOME to another file system - United States 6.30.05.00 CANDLEHOME CANDLEDATA itmCANDLEDATA.sh TECHNOTE (FAQ)

QUESTION
 How do I move local data such as configuration files, log files, historical data, etc. from CANDLEHOME to a different file system?

CAUSE
Since its inception, IBM Tivoli Monitoring (ITM) has stored local data such as configuration files, log files, and historical data together with the installation files in CANDLEHOME. For example, ITM normally installs in a directory named /opt/IBM/ITM. Within that directory, it stores programs in subdirectory names like /opt/IBM/ITM/bin and /opt/IBM/ITM/classes. It also stores local data in subdirectory names like /opt/IBM/ITM/config and /opt/IBM/ITM/logs. This homogeneous design is a problem for installations that require an approach that keeps code in /opt and stores data in the /var file system.

ANSWER
Introduction

Under APAR IV67523, ITM added a new mechanism to move local data to a different file system. For example, data typically stored in /opt/IBM/ITM/config and /opt/IBM/ITM/logs can be redirected to /var/IBM/ITM/config and /var/IBM/ITM/logs. This new file system location is designated by the user at installation time, and it is referred to as CANDLEDATA. A conversion utility is provided to implement CANDLEDATA for existing installations.

The CANDLEDATA mechanism is available with ITM 6.30.05.00.

How CANDLEDATA Works

The CANDLEDATA mechanism is implemented primarily using symbolic links. This means most of the underlying code in ITM is unaware of CANDLEDATA. This also means the CANDLEDATA mechanism is limited to Linux and UNIX platforms.

The rest of this section shows examples of links where CANDLEHOME=/opt/IBM/ITM and CANDLEDATA=/var/IBM/ITM. You can define different locations for your own installation.

Base Directory Links

The following local data directories are always linked from CANDLEHOME to CANDLEDATA:

 * /opt/IBM/ITM/InstallITM -> /var/IBM/ITM/InstallITM
 *
 * /opt/IBM/ITM/config -> /var/IBM/ITM/config
 *
 * /opt/IBM/ITM/kt1v3depot -> /var/IBM/ITM/kt1v3depot
 *
 * /opt/IBM/ITM/localconfig -> /var/IBM/ITM/localconfig
 *
 * /opt/IBM/ITM/logs -> /var/IBM/ITM/logs
 *
 * /opt/IBM/ITM/patchlogs -> /var/IBM/ITM/patchlogs
 *
 * /opt/IBM/ITM/tables -> /var/IBM/ITM/tables
 *
 * /opt/IBM/ITM/tmaitm6/agentdepot -> /var/IBM/ITM/tmaitm6/agentdepot
 *
 * /opt/IBM/ITM/tmp -> /var/IBM/ITM/tmp

These directories and links are automatically generated by ITM when the system is installed or converted to use CANDLEDATA.

General Agent Directory Links

In addition to the base set of directory links, most agents have general links for TEMA data:

 * /opt/IBM/ITM/ATTRLIB -> /var/IBM/ITM/ATTRLIB
 *
 * /opt/IBM/ITM/<platform>/<pc>/tables/ATTRLIB -> /var/IBM/ITM/ATTRLIB/<pc>
 *
 * /opt/IBM/ITM/EIFLIB -> /var/IBM/ITM/EIFLIB
 *
 * /opt/IBM/ITM/<platform>/<pc>/tables/EIFLIB -> /var/IBM/ITM/EIFLIB/<pc>
 *
 * /opt/IBM/ITM/hist -> /var/IBM/ITM/hist
 *
 * /opt/IBM/ITM/<platform>/<pc>/hist -> /var/IBM/ITM/hist/<pc>
 *
 * /opt/IBM/ITM/psit -> /var/IBM/ITM/psit
 *
 * /opt/IBM/ITM/<platform>/<pc>/psit -> /var/IBM/ITM/psit/<pc>

These directories and links are automatically generated by ITM when the agent is converted to use CANDLEDATA.

Special Agent Directory Links

Some agents have links that are specific to that agent. For example, the LZ and UX agents create the following link for the Watchdog component to store local data:

 * /opt/IBM/ITM/kca -> /var/IBM/ITM/kca

These directories and links are automatically generated by ITM when the agent is converted to use CANDLEDATA.

CANDLEDATA <-> CANDLEHOME Directory Links

The CANDLEHOME and CANDLEDATA directories also have cross references to each other:

 * /opt/IBM/IBM/registry/CANDLEDATA -> /var/IBM/ITM
 *
 * /opt/IBM/ITM <- /var/IBM/ITM/CANDLEHOME

These links are all automatically generated by ITM when the system is installed or converted to use CANDLEDATA.

Configuration Variables exploited by CANDLEDATA

In addition to symbolic links, some individual components have special configuration settings to redirect agent-specific data to CANDLEDATA. ITM redirects data using the following configuration variables:

 * CTIRA_SIT_PATH
 *
 * CANDLEHOME/
 * <platform>/<pc>/psit
 *
 *
 * KCA_IP_DIR
 *
 * CANDLEHOME/kca
 *
 *
 * KCAWD_WRITE_DIR
 *
 * CANDLEHOME/kca
 *
 *

Notes:  1. While the variables point to CANDLEHOME/xxx, the directory links cause the local data to be written to the corresponding CANDLEDATA/xxx.
 2. If you use configuration overrides that set these configuration variables, you'll need to review how those overrides work in an environment configured to use CANDLEDATA. In most cases, you'll want to remove your overrides.

Configuration Variables affected by CANDLEDATA
The symbolic links established by ITM for CANDLEDATA assume standard agent configuration. If you've modified any of the following, data will be continue to be redirected to the location you specified instead of the CANDLEDATA directory:
.

 * ATTRLIB
 *
 * CTIRA_HIST_DIR
 *
 * EIFLIB
 *
 *

When converting an existing CANDLEHOME, ITM migrates any data in the original directories before linking them to CANDLEDATA. If you've modified any of the following, you must consider whether you need to change the setting and migrate the data manually:
.  * CTIRA_SIT_FILE
 *
 *

By default, all of the following configuration variables direct data to /opt/IBM/ITM/localconfig. ITM migrates data from /opt/IBM/ITM/localconfig to /var/IBM/ITM/localconfig and then links the two. If you've modified any of these, you must consider whether you need to change the setting and migrate the data manually:
.  * CTIRA_THRESHOLDS
 *
 * IRA_EVENT_EXPORT_SNMP_TRAP_CONFIG
 *
 *
 * IRA_LOCALCONFIG_DIR
 *
 *
 * IRA_PRIVATE_SITUATION_CONFIG
 *
 *
 * IRA_SERVICE_INTERFACE_DEFAULT_PAGE
 *
 *
 * IRA_SERVICE_INTERFACE_DIR
 *
 *
 * KXX_FCP_SCRIPT_DEFINITIONS

Known Restrictions

 1.  The CANDLEDATA mechanism is available only for ITM on Linux and UNIX. ITM on Windows continues to keep local data under CANDLEHOME.
     .
 2.  No facility is provided switch from a CANDLEHOME+CANDLEDATA implementation back to a unified CANDLEHOME implementation. To do this, you must uninstall and reinstall ITM.
     .
 3.  No facility is provided to move CANDLEDATA from one directory to another. To do this, you must uninstall and reinstall ITM.
     .
 4.  The CANDLEHOME and CANDLEDATA arrangement is a 1:1 relationship.  * Only one CANDLEHOME can use a given CANDLEDATA. This means a given CANDLEDATA cannot be shared with multiple CANDLEHOMEs.
      * A given CANDLEHOME can only use one CANDLEDATA. This means components cannot be split amongst multiple CANDLEDATAs.
        .

 5.  The monitoring server and portal server cannot exploit CANDLEDATA.  * The conversion utility will not convert an existing CANDLEHOME if it contains the monitoring server or portal server.
      * The installer warns if CANDLEDATA is specified and the install image contains the monitoring server or portal server. However, the installer does not prevent monitoring server or portal server from being installed.
      * ITM does not allow the monitoring server to start if CANDLEDATA is implemented.
      * ITM does not allow the portal server to start if CANDLEDATA is implemented.
        .

 6.  Not all agents have been verified to work with CANDLEDATA. Before using CANDLEDATA, check with the support group for each of the agents you intend to install.
     .
 7.  System Monitor Agents (SMA) can exploit CANDLEDATA. However, the SMA installer does not create CANDLEDATA. These agents must be converted to use CANDLEDATA after they are installed.
     .
 8.  The CANDLEDATA mechanism is intended only for current agents. If the agent media contains installer 6.30.00.00 or above, it should be ok to use with CANDLEDATA.

     Some older or discontinued agents such as the Universal Agent (UM) and UNIX Logs agent (UL) cannot use CANDLEDATA reliably. ITM does not prevent older or discontinued agents from being installed into a new CANDLEHOME with CANDLEDATA implemented.
     .
 9.  When CANDLEDATA is in use, ITM implements internal overrides for the following configuration variables: CTIRA_SIT_PATH, KCA_IP_DIR, and KCAWD_WRITE_DIR.  * If you've already overridden any of these configuration variables, you must remove the overrides before converting a given component.
      * If you've overridden these with CANDLEHOME/config/xx.environment, the conversion utility will detect and warn about them. Your overrides will win, so you must remove them.
      * If you've overridden these with the old method of sourcing a script into CANDLEHOME/config/xx.ini, the conversion utility cannot detect them. However, the CANDLEDATA overrides will win.
        .

 10. The prerequisite scanner does not know about CANDLEDATA. It continues to assume everything is stored in CANDLEHOME. This means:  * No space checking is performed for CANDLEDATA.
      * Results are somewhat inflated for CANDLEHOME.
        .

 11. The conversion utility does not check for space when converting an existing new CANDLEHOME to use CANDLEDATA. Make sure there is enough space in CANDLEDATA before starting the conversion process.

Agents Verified with CANDLEDATA

The following agents have been verified to run properly when CANDLEDATA is implemented:

 * LO
 *
 *
 * LZ
 *
 *
 * UD
 *
 *
 * UX
 *
 *

For other agents, contact the corresponding support team.

Setting Up a New Local Installation with CANDLEDATA

For new installations, you can define the location for local data at installation time.

Local install (interactive):

 *
 * CANDLEDATA
 *
 * CANDLEHOME
 *
 *
 *
 * # ./install.sh
 *
 * INSTALL
 *
 *
 * Enter the name of the IBM Tivoli Monitoring installation directory.
 *
 * [ default = /opt/IBM/ITM ]:
 *
 * "/opt/IBM/ITM" does not exist
 *
 * Try to create it [ 1-yes, 2-no; "1" is default ]?
 *
 * Creating directory "/opt/IBM/ITM"...
 *
 *
 * Enter the name of the IBM Tivoli Monitoring local data directory.
 *
 * [ default = /opt/IBM/ITM ]: /var/IBM/ITM
 *
 * "/var/IBM/ITM" does not exist
 *
 * Try to create it [ 1-yes, 2-no; "1" is default ]?
 *
 * Creating directory "/var/IBM/ITM"...
 *
 * itmCANDLEDATA.sh: Installation directory "/opt/IBM/ITM" successfully converted to use data directory "/var/IBM/ITM".
 *
 *
 *
 * CANDLEDATA
 *
 *
 *
 *
 * CANDLEDATA
 *
 * CANDLEHOME
 *
 * CANDLEDATA
 *
 * CANDLEHOME
 *
 * CANDLEHOME
 *

Local install (silent):
 *
 * CANDLEDATA
 *
 * CANDLEDATA
 *
 *
 *
 * install.sh
   [-l
 * CANDLEDATA
 * ]
 *
   Where:  * -l
    *
    * CANDLEHOME
    *

 *
 *
 * CANDLEDATA
 *
 * install.sh
 *
 *
 *
 *
 * CANDLEDATA
 *
 * CANDLEHOME
 *
 * CANDLEDATA
 *
 * install.sh
 *

Starting an agent for the first time with CANDLEDATA

When you specify CANDLEDATA at install time, ITM establishes the base directory links. All agent-specific conversion is handled the first time a given agent is started. When this happens, an extra message is included in the agent start output: Here is an example:

# itmcmd agent start ux
Processing. Please wait...
itmCANDLEDATA.sh: Component ux successfully converted to use data directory "/var/IBM/ITM".
Starting Monitoring Agent for UNIX OS ...
Monitoring Agent for UNIX OS started

Converting an existing installation or new agents to use CANDLEDATA

For existing installations, ITM provides a utility to convert a CANDLEHOME to use CANDLEDATA. You can also use this utility to convert a newly installed agent before it is started. Under the covers, the installer runs this same utility.

itmCANDLEDATA.sh
[-b yes|no]
[-h CANDLEHOME]
[-l CANDLEDATA]
[-f no|yes]
[-p PC|*]
[-r no|yes]

Where:

 *
 * -b
 *
 * yes
 *
 * CANDLEDATA
 *
 * CANDLEHOME
 *
 * CANDLEHOME
 *
 * no
 *
 * CANDLEDATA
 *
 *
 *
 * -h
 *
 *
 *
 * -l
 *
 * CANDLEHOME
 *
 * CANDLEDATA
 *
 *
 *
 * -f
 *
 * no
 *
 * yes
 *
 *
 *
 * -p
 *
 * *
 *
 *
 *
 * -r
 *
 * no
 *
 * yes
 *

If you set the CANDLEHOME or CANDLEDATA environment variables before launching the installer, then those values are used as though they had been passed with the command options. If both the command option is used and the environment variable is defined before the conversion utility is started, the command option takes precedence.

Example 1: Conversion of a typical CANDLEHOME can be performed with an incantation similar to this:  *
 * itmCANDLEDATA.sh -l /var/IBM/ITM -b yes -p "*" -r yes

Example 2: Conversion of a newly installed agent to a CANDLEHOME where CANDLEDATA is already implemented can be performed with an incantation similar to this:  *
 * itmCANDLEDATA.sh -b no -p "ux" -r yes

Using CANDLEDATA with Remote Deploy

You can define the location for local data remotely:

tacmd createnode (new installations):

 *
 * CANDLEDATA
 *
 * CANDLEDATA
 *
 *
 *
 * tacmd createnode ... -o ENV_CANDLEDATA=
 * data_directory
 * ...
 *
 *
 *
 * install.sh
 *
 * CANDLEDATA
 *
 *

tacmd executecommand + itmCANDLEDATA.sh (existing installations):
 *
 * CANDLEDATA
 *
 * tacmd updateagent
 *
 * CANDLEDATA
 *
 * tacmd executecommand
 *
 *
 *
 * tacmd executecommand ... -c "/opt/IBM/ITM/bin/itmCANDLEDATA.sh -l /var/IBM/ITM -p \"*\" -b yes -r yes > /tmp/itmCANDLEDATA_remote.log 2>&1 &"
 *
 *
 *
 *
 *  Launches the conversion utility on the agent (/opt/IBM/ITM/bin/itmCANDLEDATA.sh). Specifies the local data directory (-l /var/IBM/ITM). Specifies all agents are to be converted (-p \"*\"). Note that the quotes are escaped because the entire command string is quoted. Specifies the CANDLEDATA directory is to be built (-b yes). Specifies the agents are to be restarted (-r yes). Redirects STDOUT and STDERR to a log file (> /tmp/itmCANDLEDATA_remote.log 2>&1). Note that the standard -o/-e/-d/-v options for tacmd executecommand don't function properly because of the agent restart. Note also that /tmp is used instead of /opt/IBM/ITM/logs; the latter is moved during the conversion process and therefore must be inactive. Launches the command in the background (trailing &). tacmd executecommand waits for the commands to complete, and this is signaled by a communication from the agent. However, since the agent is restarted by the command, it will never reply to tacmd executecommand. Running the command in the background allows tacmd executecommand to complete normally.

Other Implications

The following general ITM utilities have been updated to run properly when CANDLEDATA is implemented:

 * cinfo - The output heading indicates the location of CANDLEDATA if it implemented.
 * itmcmd agent start - Agent configurations are automatically updated if CANDLEDATA is implemented. Also, the portal server is prevented from starting if CANDLEDATA is implemented.
 * itmcmd server start - The monitoring server is prevented from starting if CANDLEDATA is implemented.
 * secureMain - Permissions and ownership in CANDLEDATA are maintained just as in CANDLEHOME. If secureMain was run before CANDLEDATA is implemented, the conversion utility automatically runs secureMain again as part of the conversion process. However, if you run the conversion utility as a nonroot user (not recommended), you must run secureMain manually after conversion is complete.
 * tacmd pdcollect and pdcollect - Data is gathered from CANDLEDATA just as from CANDLEHOME.
 * uninstall.sh - Relevant data is removed from in CANDLEDATA just as from CANDLEHOME. For uninstall.sh REMOVE EVERYTHING, both the CANDLEHOME and CANDLEDATA directories are removed.

Question: Does Linux KVM monitoring agent support CANDLEDATA function? Does Linux KVM monitoring agent in ITM support CANDLEDATA function?

Answer: The CANDLEDATA mechanism is available with ITM 6.30.05.00.


IBM Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693 - United States  SECURITY BULLETIN

SUMMARY
 A comma separated file (CSV) download feature exists in IBM BPM and WLE and is available for anonymous users. An attacker can craft a URL that can trigger a download of attacker-supplied content under an attacker-supplied file name onto the victim's machine.

VULNERABILITY DETAILS
CVEID:CVE-2016-9693 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9693]
DESCRIPTION:IBM Business Process Manager has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine.
CVSS Base Score: 7.1
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/119517 [https://exchange.xforce.ibmcloud.com/vulnerabilities/119517]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)

AFFECTED PRODUCTS AND VERSIONS
- WebSphere Lombardi Edition V7.2.0.0 - V7.2.0.5
- IBM Business Process Manager Advanced V7.5.0.0 - V7.5.1.2
- IBM Business Process Manager Advanced V8.0.0.0 - V8.0.1.3
- IBM Business Process Manager Advanced V8.5.0.0 - V8.5.7.0 including cumulative fix 2016.12

REMEDIATION/FIXES
Install IBM BPM or WLE interim fix JR57149 [http://www-01.ibm.com/support/docview.wss?uid=swg1JR57149]as appropriate for your current version.

 * IBM Business Process Manager Advanced [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Advanced&release=All&platform=All&function=aparId&apars=JR57149]
 * IBM Business Process Manager Standard [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Standard&release=All&platform=All&function=aparId&apars=JR57149]
 * IBM Business Process Manager Express [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Express&release=All&platform=All&function=aparId&apars=JR57149]
 * WebSphere Lombardi Edition [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Lombardi+Edition&release=All&platform=All&function=aparId&apars=JR57149]

As IBM Business Process Manager V7.5 and WebSphere Lombardi Edition are out of general support, customers with a support extension contract can contact IBM support to request the fix. The fix disables the vulnerable URL and uses HTML5 features to trigger CSV download without server interaction.

For WebSphere Lombardi Edition 7.2.0.0 through 7.2.0.5

 * Install Fix Pack 5 [http://www-01.ibm.com/support/docview.wss?uid=swg24034270] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V7.5.0.0 through V7.5.1.2:  * Upgrade to minimal Refresh Pack 1 [http://www-01.ibm.com/support/docview.wss?uid=swg24031230], install Fix Pack 2 [http://www-01.ibm.com/support/docview.wss?uid=swg24036462] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.0.0.0 through V8.0.1.3  * Upgrade to minimal Refresh Pack 1 [http://www-01.ibm.com/support/docview.wss?uid=swg24033777], install Fix Pack 3 [http://www-01.ibm.com/support/docview.wss?uid=swg24037734] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.0.0 through V8.5.0.2  * Install Fix Pack 2 [http://www-01.ibm.com/support/docview.wss?uid=swg24040683] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.5.0  * Apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.6.0 through V8.5.6.0 CF2  * Install CF2 [http://www-01.ibm.com/support/docview.wss?uid=swg24041303] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2016.12  * Install CF 2016.12 [https://www.ibm.com/support/docview.wss?uid=swg27048992] and then apply iFix JR57149 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
The vulnerability was reported to IBM by Nalla Muthu S and Prasath K

CHANGE HISTORY
 24 Feb 2017: initial version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Express Security Linux, Windows 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration IBM Business Process Manager Standard Security AIX, Linux, Solaris, Windows 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration WebSphere Lombardi Edition Security AIX, HP-UX, Linux, Solaris, Windows 7.2.0.5, 7.2.0.4, 7.2.0.3, 7.2.0.2, 7.2.0.1, 7.2

Question: Help with Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693 Where can I find information for Security bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693?

Answer:
CVEID:CVE-2016-9693 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9693]
DESCRIPTION:IBM Business Process Manager has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine.
CVSS Base Score: 7.1
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/119517 [https://exchange.xforce.ibmcloud.com/vulnerabilities/119517]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)


IBM How to overwrite property definition properties in a class via IBM Administration Console for Content Platform Engine (ACCE)? - United States ACCE; CE; Property; FEM TECHNOTE (FAQ)

QUESTION
 With IBM FileNet Enterprise Manager (FEM), we can follow the steps below to overwrite the property definition in a document class

1. Launch FEM
2. Expand the object store and document class tree. Right click on the document class and select "Properties"
3. Go to "Properties Definitions" tab, highlight the property definition and click "Edit"
4. Make the modification and click OK
5. Click OK again to save the change

How to perform the same operation with FileNet Content Engine - ACCE?

ANSWER
Follow the below steps to update the property definition properties on ACCE:

 1. Launch ACCE
 2. Expand the object stores folder and click the object store to open the Object store tab
 3. Expand the Data Design folder and Classes folder. Click the document class to open Document Class tab
 4. From Properties tab, open Property Definitions drop down and select the property definition you want to modify
 5. ACCE will open that property definition in a new Properties tab
 6. Modify the property definition as required
 7. Go back to the Class Definition tab and click Save

Question:
How to change the maximun string length for properties in ACCE

HI I am trying to change the maximum string length in ACCE like we will do in FEM but in the more Tab I am not seeing the option

Please guide me

Answer:
Follow the below steps to update the property definition properties on ACCE:

 1. Launch ACCE
 2. Expand the object stores folder and click the object store to open the Object store tab
 3. Expand the Data Design folder and Classes folder. Click the document class to open Document Class tab
 4. From Properties tab, open Property Definitions drop down and select the property definition you want to modify
 5. ACCE will open that property definition in a new Properties tab
 6. Modify the property definition as required
 7. Go back to the Class Definition tab and click Save


IBM Security Bulletin: Potential Privilege Escalation in WebSphere Application Server Admin Console (CVE-2017-1731) - United States  SECURITY BULLETIN

SUMMARY
 There is a potential privilege escalation in WebSphere Application Server Admin Console.

VULNERABILITY DETAILS

CVEID: CVE-2017-1731 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1731]
DESCRIPTION: IBM WebSphere Application Server could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.
CVSS Base Score: 8.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134912 [https://exchange.xforce.ibmcloud.com/vulnerabilities/134912] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

AFFECTED PRODUCTS AND VERSIONS
This vulnerability affects the following versions and releases of IBM WebSphere Application Server:

 * Version 9.0
 * Version 8.5
 * Version 8.0
 * Version 7.0

REMEDIATION/FIXES
 The recommended solution is to apply the interim fix, Fix Pack or PTF containing APARs PI89498 for each named product as soon as practical.

For WebSphere Application Server traditional and WebSphere Application Server Hypervisor Edition:

For V9.0.0.0 through 9.0.0.6:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI89498 [http://www-01.ibm.com/support/docview.wss?uid=swg24044512] [http://www-01.ibm.com/support/docview.wss?uid=swg24044155] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24044155] [http://www-01.ibm.com/support/docview.wss?uid=swg24044154]
--OR--
· Apply Fix Pack 9.0.0.7 or later.

For V8.5.0.0 through 8.5.5.13:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI89498 [http://www-01.ibm.com/support/docview.wss?uid=swg24044512] [http://www-01.ibm.com/support/docview.wss?uid=swg24044445]
--OR--
· Apply Fix Pack 8.5.5.14 or later (targeted availability 3Q2018).

For V8.0.0.0 through 8.0.0.14:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI89498 [http://www-01.ibm.com/support/docview.wss?uid=swg24044512]
--OR--
· Apply Fix Pack 8.0.0.15 or later.

For V7.0.0.0 through 7.0.0.43:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI89498 [http://www-01.ibm.com/support/docview.wss?uid=swg24044512] [http://www-01.ibm.com/support/docview.wss?uid=swg24044445] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394]
--OR--
· Apply Fix Pack 7.0.0.45 or later.

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 29 January 2018: original document published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WSRR (CVE-2017-1731) I need to understand details regarding Security Bulletin: Vulnerability identified in IBM WebSphere Application Server shipped with IBM WebSphere Service Registry and Repository (CVE-2017-1741). We are running WAS traditional V8.5.  What is the recommended fix?

Answer:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI89498 [http://www-01.ibm.com/support/docview.wss?uid=swg24044512]
--OR--
· Apply Fix Pack 8.0.0.15 or later.


IBM Configuring access for HTTP and HTTPS in Jazz for Service Management - United States jazzsm11relnotes; jazzsm1101relnotes; jazzsm1102; jazzsm1103relnotes; relnotes; jazzsm1110relnotes; jazzsm1120relnotes; jazzsm1121relnotes; HTTP; HTTPS TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 By default, the Jazz™ for Service Management application server requires HTTPS access. You can set up the environment for both HTTP and HTTPS, however HTTP access is not supported.

CAUSE
For security reasons, HTTP access is disabled by default and is not supported.

RESOLVING THE PROBLEM
Before you begin

After installing Dashboard Application Services Hub and before beginning this procedure, log in to the console to ensure that it has connectivity and can start successfully.

About this task

Configuring for HTTP and HTTPS console access involves editing theweb.xmlfile of Web components. Use this procedure to identify and edit the appropriate Web XML files.

Important: These steps are provided for information purposes only, as setting up the environment for HTTP access is not supported.

Procedure

1. Change to the following directory:JazzSM_WAS_Profile/config/cells/JazzSMNode01Cell/applications.

2. From this location, locate theweb.xmlfiles in the following directories:

 * For the Integrated Solutions Console web application archive:isc.ear/deployments/isc/isclite.war/WEB-INF
 * For the Charts web application archive:isc.ear/deployments/isc/TIPChartPortlet.war/WEB-INF
 * For the Dashboard Application Services Hub Change Password web application archive:isc.ear/deployments/isc/TIPChangePasswd.war/WEB-INF

3. Open one of the web.xmlfiles using a text editor. 4. Find the<transport-guarantee>element. The initial value of all<transport-guarantee>elements isCONFIDENTIAL, meaning that secure access is always required.

5. Change the setting toNONEto enable both HTTP and HTTPS requests. The element now reads:<transport-guarantee>NONE</transport-guarantee>.

6. Save the file, and then repeat these steps for the otherweb.xmldeployment files.

7. Stop and restart the server. [http://www.ibm.com/support/knowledgecenter/SSEKCU_1.1.2.1/com.ibm.psc.doc/admin/psc_ctr_admin_restart_jazzsm_servers.html]

Example

The following example is a section of theweb.xmlfile forTIPChangePasswdwhere the transport-guarantee parameter is set toNONE:
<security-constraint>
<display-name>
ChangePasswdControllerServletConstraint</display-name>
<web-resource-collection>
<web-resource-name>ChangePasswdControllerServlet</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>Roles</description>
<role-name>administrator</role-name>
<role-name>operator</role-name>
<role-name>configurator</role-name>
<role-name>monitor</role-name>
<role-name>iscadmins</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>

What to do next

Users must now specify a different port, depending on the mode of access. The default port numbers are as follows:
http://<host_name>:16310/ibm/console
Use the HTTP port for logging in to the Dashboard Application Services Hub on the HTTP port .
https://<host_name>:16311/ibm/console
Use the HTTPS secure port for logging in to the Dashboard Application Services Hub.

Note:If you want to use single sign-on (SSO) then you must use the fully qualified domain name of the Dashboard Application Services Hub host.

Question: Does JazzSM 1.1.2.1 support HTTP access? Does JazzSM 1.1.2.1 support HTTP access?

Answer: By default, the Jazz™ for Service Management application server requires HTTPS access. You can set up the environment for both HTTP and HTTPS, however HTTP access is not supported.


IBM Security Bulletin: IBM MQ is affected by a potential denial of service to channel processes (CVE-2017-1557) - United States  SECURITY BULLETIN

SUMMARY
 An IBM MQ application with authority to connect to a remote queue manager could send a malicious request that could cause undefined behaviour within the channel process servicing that connection, including a loss of service for other connections being serviced by the same channel process.

VULNERABILITY DETAILS
CVEID:CVE-2017-1557 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1557]
DESCRIPTION:IBM MQ could allow an authenticated user with authority to send a specially crafted request that could cause a channel process to cease processing further requests.
CVSS Base Score: 4.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/131547 [https://exchange.xforce.ibmcloud.com/vulnerabilities/131547]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

AFFECTED PRODUCTS AND VERSIONS
IBM MQ and IBM MQ Appliance v8.0.0.0 to v8.0.0.7

IBM MQ v9.0.0.0 LTS to v9.0.0.1 LTS

IBM MQ and IBM MQ Appliance v9.0.1 CD to v9.0.3 CD

REMEDIATION/FIXES
IBM MQ and IBM MQ Appliance v8.0.0.0 to v8.0.0.7

Apply fix pack 8.0.0.8 [http://www-01.ibm.com/support/docview.wss?uid=swg22010861]

IBM MQ v9.0.0.0 LTS to v9.0.0.1 LTS

Apply fix pack 9.0.0.2 [http://www-01.ibm.com/support/docview.wss?uid=swg24044038]

IBM MQ and IBM MQ Appliance v9.0.1 CD to v9.0.3 CD

Apply IBM MQ 9.0.4 [http://www-01.ibm.com/support/docview.wss?uid=swg24043348]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 22 Dec 2017 - Original Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: IBM MQ is affected by a potential denial of service to channel processes (CVE-2017-1557) I need to understand details regarding Security Bulletin: IBM MQ is affected by a potential denial of service to channel processes (CVE-2017-1557). Where can I find this information?

Answer:
CVEID:CVE-2017-1557 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1557]
DESCRIPTION:IBM MQ could allow an authenticated user with authority to send a specially crafted request that could cause a channel process to cease processing further requests.
CVSS Base Score: 4.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/131547 [https://exchange.xforce.ibmcloud.com/vulnerabilities/131547]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)


IBM Unable to add Centera Device in FileNet Content  Engine - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Errors received clicking "Test Connection" when configuring Centera Device in FileNet Enterprise Manager

SYMPTOM
After entering configuration information in FEM Fixed Content Device Wizard the following error is received:

File = .\FnFCSMGR.cpp, Line = 359, Rev.= $Revision: 1.20 $

The [initialize]operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenterFCP(0)]failed. FPLibrary (Not found in java.library.path).

Error in the p8_server_error.log:

2011-06-06T18:54:57.245Z 00C900C9 ENG FNRCC0110E - ERROR method name: initialize principal name: P270IH Global Transaction: true User Transaction: false Exception Info: The [initialize] operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenteraFCP(0)] failed.
com.filenet.api.exception.EngineRuntimeException: FNRCC0110E: CONTENT_FCP_OPERATION_FAILED: The [initialize] operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenteraFCP(0)] failed. failedBatchItem=0 errorStack={

Caused by: java.lang.UnsatisfiedLinkError: FPLibrary (Not found in java.library.path) failedBatchItem=0

Caused by: java.lang.UnsatisfiedLinkError: FPLibrary (Not found in java.library.path)

CAUSE
Changes made to the setCenteraLibPath.sh or setCenteraLibPath were not picked up by the WAS startup script. The WAS Content Engine instance was restarted from within the WAS console and not from the command line. In this Instance the setCenteraLibPath.sh file was added to the setupcmdLine.sh file but was not recognized . This caused the CenteraSDK path to not be loaded.

ENVIRONMENT
IBM Websphere

DIAGNOSING THE PROBLEM
Following error is received when "Test Connection" is clicked:

File = .\FnFCSMGR.cpp, Line = 359, Rev.= $Revision: 1.20 $

The [initialize]operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenterFCP(0)]failed. FPLibrary (Not found in java.library.path).

RESOLVING THE PROBLEM
After making any changes to the setCenteraLibPath.sh or setCenteraLibPath.bat file restart WebSphere from the IBM console or the changes will not be detected.

Cross reference information Segment Product Component Platform Version Edition Enterprise Content Management FileNet Content Manager Content Engine
HISTORICAL NUMBER
 41550
180
000

Question:
P8 CPE 5.2.1 error:  FNRCC0110E - ERROR FixedContentProviderCache.getProvider failed to init provider

New P8 CPE 5.2.1 install does not see the Centera Fixed Storage. The following error is returned:

FNRCC0110E: CONTENT_FCP_OPERATION_FAILED: The [initialize] operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenteraFCP(0)] failed. FPLibrary (Not found in java.library.path)

What is the cause?

Answer: Changes made to the setCenteraLibPath.sh or setCenteraLibPath were not picked up by the WAS startup script. The WAS Content Engine instance was restarted from within the WAS console and not from the command line. In this Instance the setCenteraLibPath.sh file was added to the setupcmdLine.sh file but was not recognized . This caused the CenteraSDK path to not be loaded.


Question: I am running WebSphere App server on 64bit JVM with plenty of free system memory,  how come I still get Native OutOfMemory errors (NOOM)? I am running WebSphere App server on 64bit JVM with plenty of free system memory,  how come I still get Native OutOfMemory errors (NOOM)?

Answer:
when using compressed references? I am using a 64bit JVM and I clearly have plenty of memory left. How can I resolve this problem?"

CAUSE

*In this note, please refer to Java Versioning: Java Version.Release.ServiceRelease.FixPack
ex: Java 7.1.4.6 is the same as Java 7.1 SR4 FP6 is the same as Java 7 R1 SR4 FP6.
The IBM JVM will automatically use compressed references [http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/topic/com.ibm.java.doc.diagnostics.60/diag/understanding/mm_compressed_references.html]when using a maximum heap size less than 25GB. This automated behavior was introduced in Java 6.1.5.0 and Java 7.0.4.0*. Compressed references (CR) decreases the size of Java objects making better use of available memory space. This better use of space results in improved JVM performance. *(Java 7.0.1.1 and later uses compressed references by default on z/OS)

See Introducing WebSphere Compressed Reference Technology [ftp://public.dhe.ibm.com/software/webserver/appserv/was/WAS_V7_64-bit_performance.pdf] for detailed information on how Compressed References work.

"When using compressed references, the size of the field used in the Java object for the Class Pointer and the Monitor/Lock is 32 bits instead of the 64bits that would be available in non-compressed mode. Because we are using 32 bits to store the location of these, and they are located in native (non-Java heap) memory, they must be allocated in the first 4GB of the address space - the maximum range we can address with the 32 bits."


Question:
P8 CPE 5.2.1 error:  FNRCC0110E - ERROR FixedContentProviderCache.getProvider failed to init provider

New P8 CPE 5.2.1 install does not see the Centera Fixed Storage. The following error is returned:

FNRCC0110E: CONTENT_FCP_OPERATION_FAILED: The [initialize] operation on the fixed content provider [com.filenet.engine.content.fcprovider.centera.CenteraFCP(0)] failed. FPLibrary (Not found in java.library.path)

How do I fix this?

Answer: After making any changes to the setCenteraLibPath.sh or setCenteraLibPath.bat file restart WebSphere from the IBM console or the changes will not be detected.


IBM Automated data collection capability provided by wpcollector tool - United States wpcollector isalite isa lite data collection collector diagnostics TECHNOTE (FAQ)

QUESTION
 What are the benefits of the wpcollector tool? How do I use this tool?

ANSWER
Wpcollector is a command line tool that automates the collection of portal logs and configuration files. Using automated log collection early in the Case life cycle can greatly reduce the number of doc requests that are made by Support.

Wpcollector is delivered with WebSphere Portal beginning with the 7.0 release. If tracing is required for the problem scenario, you must manually enable traceStrings and recreate the problem PRIOR to running wpcollector.

To run wpcollector, please follow the steps, below:

 * If IBM Support has requested tracing, enable it as instructed by the L2 Support Engineer and then recreate the problem. If no tracing is requested, proceed to the step, below:

 * If using Microsoft Windows, Unix/Linux, or IBM i, run the following script from the <wp_profile_root> [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/reference/wpsdirstr.dita]/PortalServer/bin/ directory to begin the collection:  *
    *
    *  Unix/Linux: wpcollector.sh
    *  i: wpcollector.sh
    *
    * Tip: To specify the option for collecting files for the Deployment Manager profile, use the "dmgr.root" parameter. For example:
    *  wpcollector.bat -Ddmgr.root=/opt/IBM/WebSphere/profiles/dmgr_profile

 * If using IBM z/OS, proceed as follows [../reference/wpsdirstr.html%5C]:  *
    *
    *  In the Portal configuration panel, select Collect Diagnostics.
    *  Follow the Customization Dialog instructions for submitting the Collect Diagnostics job (EJPSLOGS).
    *
    * Tip: To collect data from the Deployment Manager, the only requirement is to submit the job from the system where the Deployment Manager is installed (i.e. so it can access the files). There is no prompt in the ISPF panel for this.

 * Locate the wp.mustgather-<timestamp>.zip file in the <wp_profile_root> [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/reference/wpsdirstr.dita]/filesForAutoPD/ directory and follow the instructions in "Exchanging information with IBM Technical Support for problem determination" [http://www-01.ibm.com/support/docview.wss?uid=swg21153852] to manually FTP the collection to IBM. If using z/OS, there may be additional z/OS-specific files required, such as WebSphere Portal servant region or controller region joblogs. Wpcollector currently does not collect these files. Your L2 Support Engineer will inform you in the event these files are needed and provide instructions for collecting them.

 * If tracing was requested and enabled, please follow the instructions provided by the L2 Support Engineer to disable tracing from the environment

RELATED INFORMATION
 Data Collection and Symptom Analysis [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/trouble/tbl_apdt_over.dita?lang=en]

Question: What exactly is "wpcollector" in WebSphere Portal Server? I've been told to get wpcollector output? What exactly is this?

Answer: Wpcollector is a command line tool that automates the collection of portal logs and configuration files. Using automated log collection early in the Case life cycle can greatly reduce the number of doc requests that are made by Support.


IBM PI37248: A PROPERTY FILE BASED CONFIGURATION (PFBC) FILE MIGHT FAIL TO AP PLY. - United States   FIXES ARE AVAILABLE
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6 [http://www-01.ibm.com/support/docview.wss?uid=swg24040035]
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11 [http://www-01.ibm.com/support/docview.wss?uid=swg24040425]
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7 [http://www-01.ibm.com/support/docview.wss?uid=swg24040533]
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8 [http://www-01.ibm.com/support/docview.wss?uid=swg24041178]
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12 [http://www-01.ibm.com/support/docview.wss?uid=swg24041590]
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9 [http://www-01.ibm.com/support/docview.wss?uid=swg24041819]
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10 [http://www-01.ibm.com/support/docview.wss?uid=swg24042150]
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11 [http://www-01.ibm.com/support/docview.wss?uid=swg24043005]
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24042746]
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12 [http://www-01.ibm.com/support/docview.wss?uid=swg24043844]
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14 [http://www-01.ibm.com/support/docview.wss?uid=swg24044096]
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24044479]
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15 [http://www-01.ibm.com/support/docview.wss?uid=swg24044734]

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  A PFBC file might fail to apply. Wsadmin will show an error
   similar to this:

   java.lang.Exception: java.lang.Exception: ADMG0660E:
   Properties File Validation during command
   applyConfigProperties failed.  See Report file for details.

   The report file will contain an error similar to this:
   Error=java.lang.NullPointerException
    at
   com.ibm.websphere.management.configservice.ConfigServiceHelper.g
   etConfigDataType(ConfigServiceHelper.java:235)
    at
   com.ibm.ws.management.configservice.WorkspaceHelper.getType(Work
   spaceHelper.java:563)
    at
   com.ibm.ws.management.configservice.WorkspaceHelper.getDelegator
   (WorkspaceHelper.java:584)
    at
   com.ibm.ws.management.configservice.ConfigServiceImpl.getAttribu
   tes(ConfigServiceImpl.java:2102)
    at
   com.ibm.ws.management.commands.properties.resources.common.Apply
   Properties.setProperties(ApplyProperties.java:240)

LOCAL FIX

PROBLEM SUMMARY
 *  ****************************************************************
   * USERS AFFECTED:  All users of IBM WebSphere Application      *
   *                  Server Property File Based Configuration    *
   ****************************************************************
   * PROBLEM DESCRIPTION: A Property File Based Configuration     *
   *                      (PFBC) file might fail to apply.        *
   ****************************************************************
   * RECOMMENDATION:                                              *
   ****************************************************************
   A recent (8.5.5.5) parser change introduced a problem where
   types that have default values noted in the file and are not
   Strings can be incorrectly processed.  For example:
   isolatedClassLoader=false #boolean,default(false)
   might be incorrectly processed, and as a result, the file
   might not apply.

PROBLEM CONCLUSION
 *  The parsing code is updated so the problem no longer occurs.

   The fix for this APAR is currently targeted for inclusion in
   fix pack 8.5.5.6.  Please refer to the Recommended Updates
   page for delivery information:
   http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980 [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980]

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PI37248

 * REPORTED COMPONENT NAME
   WEBS APP SERV N

 * REPORTED COMPONENT ID
   5724H8800

 * REPORTED RELEASE
   850

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt / Xsystem

 * SUBMITTED DATE
   2015-03-18

 * CLOSED DATE
   2015-03-20

 * LAST MODIFIED DATE
   2015-03-24

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:

FIX INFORMATION
 * FIXED COMPONENT NAME
   WEBS APP SERV N

 * FIXED COMPONENT ID
   5724H8800

APPLICABLE COMPONENT LEVELS
 * R850 PSY
   UP

Question: Portal v8.5 install fails with INSTCONFFAILED - No Portral logs are written Portal v8.5 install fails with INSTCONFFAILED - No Portral logs are written

Answer:
The parsing code is updated so the problem no longer occurs.

   The fix for this APAR is currently targeted for inclusion in
   fix pack 8.5.5.6.


IBM Removing a failed install from the ITM i5/OS agent - United States i5 removal TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 If an ITM i5/OS agent DLTLICPGM 5724C04 command fails then we have to remove the various parts of the agent that have been installed. This has to be done by hand because the DLTLICPGM 5724C04 command will fail as the unistall encounter some issues during uninstall. This technote will show how to do it.

SYMPTOM
RSTLICPGM command fails to install the ITM i5/OS agent.

DLTLICPGM 5724C04 command fails to uninstall the agent

CAUSE
RSTLICPGM/DLTLICPGM 5724C04 command failed to finish correctly and leaves the agent in an unknown state.

ENVIRONMENT
IBM i / i5/OS machines

DIAGNOSING THE PROBLEM
RSTLICPGM and DLTLICPGM 5724C04 fail for the i5 agent.

RESOLVING THE PROBLEM

 To delete the ITM i5/OS agent do the following :-

First try DLTLICPGM 5724C04 for the Tivoli agent. If that does not work then do
the following i5/OS commands :

DLTLIB QAUTOMON
DLTLIB QAUTOTMP
DLTUSRPRF QAUTOMON and choose to remove all objects owned by this user.

start qsh
delete /QIBM/USERDATA/IBM/ITM and all sub directories in it.
delete /QIBM/PRODDATA/IBM/ITM and all sub directories in it.

Retry the RSTLICPGM commands specified in the user guide.
http://www-01.ibm.com/support/knowledgecenter/SSTFXA_6.3.0/com.ibm.itm.doc_6.3/osibmi/pcinstall_a4_ug.htm?lang=en [http://www-01.ibm.com/support/knowledgecenter/SSTFXA_6.3.0/com.ibm.itm.doc_6.3/osibmi/pcinstall_a4_ug.htm?lang=en]

PRODUCT ALIAS/SYNONYM
 ITM OS/400 agent
ITM i5/OS agent
ITM IBM i agent
5724C04

Question:
Uninstalling I5 OS agent failed

I need to uninstall the I5OS agent before reinstalling a newer release of the same.

Command: DLTLICPGM LICPGM(5724C04)

is anyway failing and I don't know how to proceed further.

Can you please let me know the manual steps to uninstall the i5OS agent correctly ?

Answer:
To delete the ITM i5/OS agent do the following :-

First try DLTLICPGM 5724C04 for the Tivoli agent. If that does not work then do
the following i5/OS commands :

DLTLIB QAUTOMON
DLTLIB QAUTOTMP
DLTUSRPRF QAUTOMON and choose to remove all objects owned by this user.

start qsh
delete /QIBM/USERDATA/IBM/ITM and all sub directories in it.
delete /QIBM/PRODDATA/IBM/ITM and all sub directories in it.

Retry the RSTLICPGM commands specified in the user guide.


IBM Guardium STAP does not connect properly and does not show in the S-TAP Control - I see some specific errors in some log files. - United States  TECHNOTE (FAQ)

QUESTION
 What can cause an STAP to fail to connect properly - I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :-
"Server <ip_addr> wasn't heard from for nn sec during this attempt (nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log
"Unauthorized client connecting from <ip_addr> ,rejecting"

CAUSE
One reason for these errors could be that the S-TAP Approval Needed is checked in the S-TAP Certification screen on the Appliance like this :-
[/support/docview.wss?uid=swg22009818&aid=1] [/support/docview.wss?uid=swg22009818&aid=1]

ANSWER
Uncheck the Approval box and the S-TAPs should start connecting .

[/support/docview.wss?uid=swg22009818&aid=2] [/support/docview.wss?uid=swg22009818&aid=2]

Question:
Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :- "Server wasn't heard from for nn sec during this attempt nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log "Unauthorized client connecting from ,rejecting"

What is the reason?

Answer: One reason for these errors could be that the S-TAP Approval Needed is checked in the S-TAP Certification screen on the Appliance


IBM Minimum authorization required for SAP agent logon userid - United States authorization minimum IBMMON_AGENT profile settings agent userid SAP MySAP /IBMMON/AUTH TECHNOTE (FAQ)

QUESTION
 What are the minimum authorizations required for the userid used by the ITM MySAP agent to logon a SAP system?

ANSWER
By default, the MySAP agent uses the userid IBMMON_AGENT, that is created when ITM transport are imported in the SAP system, together with /IBMMON/AUTH role and profile.
If you don't want to use the default userid and profile, you need to create your own userid and provide it with a set of minimum required authorization settings.
Depending on the transport level, the required authorization may vary, but you can always refer to the values specified for the /IBMMON/AUTH profile available in the transport.
By looking at this profile, you can obtain the needed authorization information.
In example, for MySAP agent 6.2 IF16, those are the authorization defined for the /IBMMON/AUTH profile:

[/support/docview.wss?uid=swg21657458&aid=1] [/support/docview.wss?uid=swg21657458&aid=1]

You need to define your own userid providing the same set of authorization showed for the /IBMMON/AUTH profile to have mySAP agent performing successful data collection even using a non-default userid.

PRODUCT ALIAS/SYNONYM
 IBM Tivoli Monitoring MySAP Agent 6.2

Question:
SAP Agent user authorizations

Hello, I cannot use the default SAP user IBMMON_AGENT provided by the SAP Agent transport. Internal rules requires to create a new user respecting specific naming convention. I know how to do it but I don't know the authorization I need to assign to the new user. Where can I find them ?

Thanks

Answer:
By default, the MySAP agent uses the userid IBMMON_AGENT, that is created when ITM transport are imported in the SAP system, together with /IBMMON/AUTH role and profile.
If you don't want to use the default userid and profile, you need to create your own userid and provide it with a set of minimum required authorization settings.
Depending on the transport level, the required authorization may vary, but you can always refer to the values specified for the /IBMMON/AUTH profile available in the transport.
By looking at this profile, you can obtain the needed authorization information.


IBM Operational Decision Manager V8.5.1.2 Fix Pack - United States  DOWNLOADABLE FILES

ABSTRACT
 This cumulative fix pack updates Operational Decision Manager V8.5.1 and V8.5.1.1 to V8.5.1.2.

DOWNLOAD DESCRIPTION
This fix pack is entitled. Only customers who have purchased Operational Decision Manager V8.5.1 can use this fix pack.

How to install the fix pack
If you are not installing both Operational Decision Manager components, skip the instructions regarding Decision Center or Decision Server.

 1. For Decision Center, download 8.5.1-WS-ODM_DC-<OS>-FP002.zip, and extract its files. (Change <OS> to match your platform: AIX, HPUX, LINUX, OS400, SOLARIS, ZOS, or WIN32.)
 2. Extract the archive to a new folder, named WDC.
 3. For Decision Server, Download 8.5.1-WS-ODM_DS-<OS>-FP002.zip, and extract its files. (Change <OS> to match your platform: AIX, HPUX, LINUX, OS400, SOLARIS, ZOS, or WIN32.)
 4. Extract the archive to a new folder, named WDS.

Installing by using IBM Installation Manager:  1.  Launch IBM Installation Manager.
 2.  In the toolbar menu, open File > Preferences and do the following:
 3.  Select repositories.
 4.  For Decision Center, click Add Repository.
 5.  Browse to the extracted folder WDC\updates.
 6.  Select the file repository.config.
 7.  For Decision Server, click Add Repository.
 8.  Browse to the extracted folder WDS\updates.
 9.  Select the file repository.config.
 10. Make sure the repositories are selected in the Repositories list.
 11. Click Apply to save your changes, and click OK to close the Repositories list.
 12. Click Update to update your installation.
 13. Follow the instructions in the installation manager to complete the installation.

Installing by using the Installation Manager command line:  1. Locate the imcl command under <IM installation>/eclipse/tools.
 2. Run the commandimcl updateAll -repositories WDC/updates,WDS/updates -acceptLicense.

 * Use the option -installDirectory <install path of ODM 8.5.1> to update a specific installation.
 * If you update only Decision Server or Decision Center, specify the repository accordingly.

Applying the fix pack
After you install the fix pack, you might have to do additional steps to apply the fix pack in your environment. To complete the update, see When and how to apply a modification or fix pack [http://www-01.ibm.com/support/docview.wss?uid=swg21665766].

Warning:
If you have installed interim fixes for Operational Decision Manager V8.5.1, you must uninstall the fixes before you can install this fix pack. You must also stop the Operational Decision Manager sample server for this installation. If you do not uninstall the fixes and stop the server, the installation of the fix pack fails. If you attempt to install the fix pack without uninstalling the interim fixes, the installer uninstalls the interim fixes before the installer fails. In this case, stop the sample server and restart the installation. INSTALLATION INSTRUCTIONS
Follow the instructions provided in the following resources:

DOWNLOAD PACKAGE

PROBLEMS SOLVED
Fix List for IBM Operational Decision Manager [http://www.ibm.com/support/docview.wss?uid=swg27023767]

Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options
What is Fix Central(FC)? [https://www.ibm.com/support/fixcentral/help?page=swfaqs]
What is DD? [http://www6.software.ibm.com/dldirector/doc/DDfaq_en.html] ODM 8.5.1.0 AIX 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=AIX&function=all] [ ] DD ODM 8.5.1.0 HPUX 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=HPUX&function=all] [ ] DD ODM 8.5.1.0 Linux PPC 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Linux+PPC&function=all] [ ] DD ODM 8.5.1.0 Linux x86 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Linux+x86&function=all] [ ] DD ODM 8.5.1.0 Linux zSeries 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Linux+zSeries&function=all] [ ] DD ODM 8.5.1.0 OS/400 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=OS/400&function=all] [ ] DD ODM 8.5.1.0 Solaris 32-bit SPARC 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Solaris+32-bit,SPARC&function=all] [ ] DD ODM 8.5.1.0 Solaris 64-bit SPARC 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Solaris+64-bit,SPARC&function=all] [ ] DD ODM 8.5.1.0 Solaris 32-bit x86 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Solaris+32-bit,x86&function=all] [ ] DD ODM 8.5.1.0 Solaris 64-bit x86 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Solaris+64-bit,x86&function=all] [ ] DD ODM 8.5.1.0 Windows 30 Jan 2015 Language Independent 4000000000 FC [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.0&platform=Windows&function=all] [ ] DD
 [/support/docview.wss?uid=swg24039235&aid=1]Problems (APARS) fixed [/support/docview.wss?uid=swg24039235&aid=2]Problems (APARS) fixed
PI31830, PI31844, RS01612, RS01617, RS01630, RS01631, RS01635, RS01641, RS01645, RS01646, RS01653, RS01661, RS01664, RS01667, RS01668, RS01669, RS01670, RS01671, RS01680, RS01682, RS01683, RS01685, RS01686, RS01689, RS01690, RS01693, RS01694, RS01695, RS01697, RS01698, RS01700, RS01704, RS01707, RS01708, RS01709, RS01710, RS01711, RS01712, RS01714, RS01715, RS01716, RS01718, RS01720, RS01723, RS01725, RS01728, RS01733, RS01734, RS01735, RS01737, RS01743, RS01744, RS01748, RS01750, RS01751, RS01752, RS01754, RS01755, RS01760, RS01763, RS01768, RS01770, RS01774, RS01775, RS01779, RS01784, RS01790, RS01792, RS01793, RS01794, RS01795, RS01796, RS01798, RS01801, RS01804, RS01806, RS01809, RS01811, RS01813, RS01814, RS01817, RS01818, RS01819, RS01821, RS01824, RS01825, RS01827, RS01828, RS01831, RS01832, RS01850, RS01853, RS01854, RS01855, RS01856, RS01858, RS01859, RS01860, RS01862, RS01699

Question: How to get the ODM 8.5.1.2 fixpack of ODM 8.5.1.1? ODM 8.5.1.2 fixpack is not listed in Fix Central when installed platform ODM 8.5.1.1 is used: http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Operational+Decision+Management&release=8.5.1.1&platform=All&function=all

Answer: This cumulative fix pack updates Operational Decision Manager V8.5.1 and V8.5.1.1 to V8.5.1.2.